chore: remove unused npm modules in Docke build

* fix: handle empty password, missing port, and TLS in Redis URL parsing
---------

Co-authored-by: Philipinho <16838612+Philipinho@users.noreply.github.com>

Dockerfile

@@ -18,6 +18,15 @@ RUN apt-get update \
   && apt-get install -y --no-install-recommends curl bash \
   && rm -rf /var/lib/apt/lists/*
 
+# drop npm and corepack
+RUN rm -rf /usr/local/lib/node_modules/npm \
+  && rm -rf /usr/local/lib/node_modules/corepack \
+  && rm -rf /usr/local/bin/npm \
+  && rm -rf /usr/local/bin/npx \
+  && rm -rf /usr/local/bin/corepack \
+  && rm -rf /root/.npm \
+  && rm -rf /root/.node-gyp
+
 WORKDIR /app
 
 # Copy apps

apps/server/src/app.module.ts

@@ -22,7 +22,8 @@ import { TelemetryModule } from './integrations/telemetry/telemetry.module';
 import { RedisModule } from '@nestjs-labs/nestjs-ioredis';
 import { RedisConfigService } from './integrations/redis/redis-config.service';
 import { CacheModule } from '@nestjs/cache-manager';
-import KeyvRedis from '@keyv/redis';
+import KeyvRedis, { defaultReconnectStrategy } from '@keyv/redis';
+import { parseRedisUrl } from './common/helpers';
 import { LoggerModule } from './common/logger/logger.module';
 import { ClsModule } from 'nestjs-cls';
 import { NoopAuditModule } from './integrations/audit/audit.module';
@@ -62,10 +63,20 @@ try {
       isGlobal: true,
       useFactory: async (environmentService: EnvironmentService) => {
         const redisUrl = environmentService.getRedisUrl();
+        const { family, tls } = parseRedisUrl(redisUrl);
 
         return {
           ttl: 5 * 1000,
-          stores: [new KeyvRedis(redisUrl)],
+          stores: [
+            new KeyvRedis({
+              url: redisUrl,
+              socket: {
+                family,
+                reconnectStrategy: defaultReconnectStrategy,
+                ...tls,
+              },
+            }),
+          ],
         };
       },
       inject: [EnvironmentService],

apps/server/src/collaboration/collaboration.gateway.ts

@@ -66,6 +66,7 @@ export class CollaborationGateway {
           password: this.redisConfig.password,
           db: this.redisConfig.db,
           family: this.redisConfig.family,
+          tls: this.redisConfig.tls,
           retryStrategy: createRetryStrategy(),
         }),
         serverId: `collab-${os?.hostname()}-${nanoid(10)}`,

apps/server/src/common/helpers/utils.ts

@@ -30,13 +30,14 @@ export type RedisConfig = {
   db: number;
   password?: string;
   family?: number;
+  tls?: { rejectUnauthorized?: boolean };
 };
 
 export function parseRedisUrl(redisUrl: string): RedisConfig {
-  // format - redis[s]://[[username][:password]@][host][:port][/db-number][?family=4|6]
+  // format - redis[s]://[[username][:password]@][host][:port][/db-number][?family=4|6][&rejectUnauthorized=false]
   const url = new URL(redisUrl);
-  const { hostname, port, password, pathname, searchParams } = url;
-  const portInt = parseInt(port, 10);
+  const { hostname, port, password, pathname, protocol, searchParams } = url;
+  const portInt = port ? parseInt(port, 10) : 6379;
 
   let db: number = 0;
   // extract db value if present
@@ -54,7 +55,14 @@ export function parseRedisUrl(redisUrl: string): RedisConfig {
     family = parseInt(familyParam, 10);
   }
 
-  return { host: hostname, port: portInt, password, db, family };
+  const tls =
+    protocol === 'rediss:'
+      ? searchParams.get('rejectUnauthorized') === 'false'
+        ? { rejectUnauthorized: false }
+        : {}
+      : undefined;
+
+  return { host: hostname, port: portInt, password: password || undefined, db, family, tls };
 }
 
 export function createRetryStrategy() {

apps/server/src/core/space/services/space-member.service.ts

@@ -339,15 +339,25 @@ export class SpaceMemberService {
       return;
     }
 
-    if (spaceMember.role === SpaceRole.ADMIN) {
-      await this.validateLastAdmin(dto.spaceId);
-    }
+    await executeTx(this.db, async (trx) => {
+      await trx
+        .selectFrom('spaces')
+        .select('id')
+        .where('id', '=', dto.spaceId)
+        .forUpdate()
+        .executeTakeFirst();
 
-    await this.spaceMemberRepo.updateSpaceMember(
-      { role: dto.role },
-      spaceMember.id,
-      dto.spaceId,
-    );
+      if (spaceMember.role === SpaceRole.ADMIN) {
+        await this.validateLastAdmin(dto.spaceId, trx);
+      }
+
+      await this.spaceMemberRepo.updateSpaceMember(
+        { role: dto.role },
+        spaceMember.id,
+        dto.spaceId,
+        trx,
+      );
+    });
 
     this.auditService.log({
       event: AuditEvent.SPACE_MEMBER_ROLE_CHANGED,
@@ -368,10 +378,14 @@ export class SpaceMemberService {
     });
   }
 
-  async validateLastAdmin(spaceId: string): Promise<void> {
+  async validateLastAdmin(
+    spaceId: string,
+    trx?: KyselyTransaction,
+  ): Promise<void> {
     const spaceOwnerCount = await this.spaceMemberRepo.roleCountBySpaceId(
       SpaceRole.ADMIN,
       spaceId,
+      trx,
     );
     if (spaceOwnerCount === 1) {
       throw new BadRequestException(

apps/server/src/database/repos/space/space-member.repo.ts

@@ -46,8 +46,10 @@ export class SpaceMemberRepo {
     updatableSpaceMember: UpdatableSpaceMember,
     spaceMemberId: string,
     spaceId: string,
+    trx?: KyselyTransaction,
   ): Promise<void> {
-    await this.db
+    const db = dbOrTx(this.db, trx);
+    await db
       .updateTable('spaceMembers')
       .set(updatableSpaceMember)
       .where('id', '=', spaceMemberId)
@@ -92,8 +94,13 @@ export class SpaceMemberRepo {
       .execute();
   }
 
-  async roleCountBySpaceId(role: string, spaceId: string): Promise<number> {
-    const { count } = await this.db
+  async roleCountBySpaceId(
+    role: string,
+    spaceId: string,
+    trx?: KyselyTransaction,
+  ): Promise<number> {
+    const db = dbOrTx(this.db, trx);
+    const { count } = await db
       .selectFrom('spaceMembers')
       .select((eb) => eb.fn.count('role').as('count'))
       .where('role', '=', role)

apps/server/src/integrations/health/redis.health.ts

@@ -5,6 +5,7 @@ import {
 import { Injectable, Logger } from '@nestjs/common';
 import { EnvironmentService } from '../environment/environment.service';
 import { Redis } from 'ioredis';
+import { parseRedisUrl } from '../../common/helpers';
 
 @Injectable()
 export class RedisHealthIndicator {
@@ -19,8 +20,10 @@ export class RedisHealthIndicator {
     const indicator = this.healthIndicatorService.check(key);
 
     try {
-      const redis = new Redis(this.environmentService.getRedisUrl(), {
+      const redisUrl = this.environmentService.getRedisUrl();
+      const redis = new Redis(redisUrl, {
         maxRetriesPerRequest: 15,
+        tls: parseRedisUrl(redisUrl).tls,
       });
 
       await redis.ping();

apps/server/src/integrations/queue/queue.module.ts

@@ -18,6 +18,7 @@ import { GeneralQueueProcessor } from './processors/general-queue.processor';
             password: redisConfig.password,
             db: redisConfig.db,
             family: redisConfig.family,
+            tls: redisConfig.tls,
             retryStrategy: createRetryStrategy(),
           },
           defaultJobOptions: {

apps/server/src/integrations/redis/redis-config.service.ts

@@ -19,6 +19,7 @@ export class RedisConfigService implements RedisOptionsFactory {
         password: redisConfig.password,
         db: redisConfig.db,
         family: redisConfig.family,
+        tls: redisConfig.tls,
         retryStrategy: createRetryStrategy(),
       },
     };

apps/server/src/ws/adapter/ws-redis.adapter.ts

@@ -17,6 +17,7 @@ export class WsRedisIoAdapter extends IoAdapter {
 
     const options: RedisOptions = {
       family: this.redisConfig.family,
+      tls: this.redisConfig.tls,
       retryStrategy: createRetryStrategy(),
     };
 

packages/editor-ext/src/lib/embed-provider.ts

@@ -73,9 +73,13 @@ export const embedProviders: IEmbedProvider[] = [
     id: "vimeo",
     name: "Vimeo",
     regex:
-      /^(https:)?\/\/(?:www\.|player\.)?vimeo.com\/(?:channels\/(?:\w+\/)?|groups\/([^/]*)\/videos\/|album\/(\d+)\/video\/|video\/|)(\d+)/,
-    getEmbedUrl: (match) => {
-      return `https://player.vimeo.com/video/${match[4]}`;
+      /^(https:)?\/\/(?:www\.|player\.)?vimeo.com\/(?:channels\/(?:\w+\/)?|groups\/([^/]*)\/videos\/|album\/(\d+)\/video\/|video\/|)(\d+)(?:\/([\da-zA-Z]+))?/,
+    getEmbedUrl: (match, url: string) => {
+      // preserve ?h= hash for unlisted videos
+      const hash =
+        match[5] ?? new URL(url, "https://vimeo.com").searchParams.get("h");
+      const base = `https://player.vimeo.com/video/${match[4]}`;
+      return hash ? `${base}?h=${hash}` : base;
     },
   },
   {